6 Ways to Prevent Buffer Overflow Attacks

A buffer overflow attack is an attack that exploits a buffer overflow vulnerability. Buffer overflow is a very common and dangerous vulnerability that is widespread in various operating systems and applications. Buffer overflow attacks can lead to program failures, system shutdowns, reboots, and other consequences.

A buffer overflow is when the computer fills the buffer with bits of data that exceeds the capacity of the buffer itself, and the overflowed data is overwritten on legitimate data. Ideally, the program checks the length of the data and does not allow characters that exceed the length of the buffer.

However, the vast majority of programs assume that the data length always matches the allocated storage space, which is a hidden danger for buffer overflows. The buffers used by the operating system, also known as stacks, are temporarily stored in the stack between operational processes, and the stack will also overflow.

That's how I do it in general.

1 Look for system vulnerabilities. Look for vulnerabilities that can be used as buffer overflows. Of course, this must be based on your precise goal and a certain understanding of the goal.

For example, the target's operating system, open services, and permanent programs (this must be the program opened by the administrator user). You can check it online, it's best not to look for it yourself, this one is found out of thin air, it is generally more difficult and troublesome. Many foreign hackers will announce the latest vulnerabilities, and there are some in China where E language is inconvenient, but it is relatively slow in China.

Of course, there are some so-called tools that can scan it, but unless you don't have a fixed target to attack anyone, it is generally not very useful for fixed target scanning.

2 Disassembled vulnerability section**. If it is an open-source system or program, disassemble to obtain the overflow stack address, that is, the function pointer address returned after the function is called.

It's hard to do this for the first time, so it's best to find someone to guide you, of course, you can also find me, it's free, but you need to have some basic knowledge of GDB and assembly language. (You don't have to be too strong, you can just scratch the surface, because I'm not strong either), of course, a considerable part of the published vulnerabilities will be announced.

3. Write the execution ** corresponding to the buffer overflow address, and then use the buffer overflow vulnerability to map the address returned by the stack function to your execution function. You have to write this beforehand. For your purpose, you can elevate your rights, or copy a file or something, depending on your own hobbies, win and linux use exe functions to execute shell or direct system calls, anyway, you already have administrator privileges.

There are many of these ** who don't want to write on the Internet, and the principle is very simple.

4 Sweep the tail. Especially for the servers of large ** or large companies, don't forget to change the changed things back if you don't want people to find out, of course, you can manually create a program with vulnerabilities, and then run it regularly with administrator privileges to prepare for the next entry. Such programs are generally not very sensitive to antivirus software (as long as you don't change people's passwords), run regularly, and don't let people see the process.

The above is just the simplest principle step, and the masters will use a lot of superb skills on this basis, of course, the specific problem must be adapted to local conditions, which is not a sentence or two to make it clear, I hope it will help you.

Please comply with local laws and do not engage in illegal activities.

Probably is: when all programs are executed, the data or instructions are first transferred into the buffer, and then into the register, the buffer has a size, and the normal program tries not to exceed the size of the buffer (beyond which it will overwrite the instructions or data that entered the buffer first), and the buffer can be operated by the programmer. In this way, you can overwrite the normal data and instructions with your own data and instructions that deliberately exceed the size of the buffer, so as to execute your own instructions with ulterior motives.